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IT'S  SNOW  TIME  AGAIN! 


^ Whenever  we  see  a commercial  on  TV,  an  advertisement:  in  a magazine  or 
a safety  article  about  winter  driving  and  automotive  maintenance,  we  want 
to  "turn  it  off."  It's  old  hat  --  the  same  old  warnings,  the  same  "do's" 
and  "don't 's,"  the  same  "nevers"  and  "always." 

But  whenever  you  stop  to  think  about  it,  there  is  rarely  anything  new 
about  common  sense  in  regard  to  safe  practices.  It's  a simple  fact  that 
if  a person  hears  a thing  often  enough,  it  will  become  second  nature  for 
him  to  think  about  what's  safe  and  what  isn't  when  a given  situation  arises. 
Thus,  the  reason  for  talking  up  winter  driving  safety  over  and  over  again. 
The  driver  must  know  what  to  do  and  when  to  do  it,  and  how  to  prepare  for 
what  might  happen. 

• Everyone  knows  that  ice  and  snow  pose  dangerous  driving  problems. 

The  routine  20-minute  drive  to  work  in  the  morning  can  easily  turn  into  an 
hour's  hazardous  struggle.  Drivers'  nerves  begin  to  get  on  edge,  as  they 
wonder  if  they're  going  to  get  to  work  on  time  and  without  denting  a fender 
on  the  new  car.  Take  it  easy!  Don't  try  to  rush.  It's  better  to  be  late 
for  work  than  to  leave  a widow  with  four  small  children. 

•Watch  the  distance  between  you  and  the  car  in  front  of  you.  Leave 
three  or  four  times  more  space  in  front  of  you  than  you  would  under  ordi- 
nary driving  conditions. 

•What  about  those  tires?  Is  the  tread  good?^  Snow  tires  are  better. 
Studded  tires  are  better  than  snow  tires.  Chains  are  best  of  all.  The 
extra  feet  of  stopping  distance  you  save  with  good  tires  or  chains  may 
mean  the  difference  between  an  accident  and  a safe  stop. 

• Do  your  windshield  wipers  work  perfectly?  Visibility  is  low  enough 
in  a snow  storm,  let  alone  having  wiper  blades  that  miss  and  streak.  Use 
those  windshield  washers  --  but  not  unless  you're  sure  the  water  won't 
freeze  when  it  hits  your  windshield.  If  necessary,  pull  off  the  road  -- 
well  off  the  road  --  and  wipe  the  car  windows  clean. 

•How  about  your  car's  exhaust  system?  Don't  add  the  danger  of  carbon 
monoxide  inside  your  car  to  the  snow  and  ice  on  the  outside.  Have  the  ex- 
haust system  checked  before  cold  weather  sets  in.  Just  a few  minutes  in  a 
carbon  monoxide  atmosphere  won't  give  you  time  to  have  it  checked  later. 

(Cont  on  page  18  .) 
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IT'S  POSSIBLE  FOR  THE  IMPOSSIBLE  TO  BE  POSSIBLE 


Julian  L.  Vann,  Chief  Safety  Engineer 
Harvey  Aluminum  Sales,  Inc. 

Milan  Army  Ammunition  Plant 


The  above  photograph  shows  (left  to  right)  Paul  Hardison,  Dee  C. 
McPeake  and  Laymon  T.  Goldsmith.  The  story  about  the  three  men  would  be 
classified  as  fiction  by  the  layman.  Although  we  don't  really  know  how 
the  insurance  actuaries  would  establish  probabilities  for  such  a feat,  we 
are  betting  these  three  men  have  established  a notorious  collective  rec- 
ord in  the  area  of  safety.  Mr.  McPeake,  Mr.  Hardison  and  Mr.  Goldsmith 
have  worked  at  the  same  plant  as  professional  vehicle  drivers  for  a col- 
lective total  of  90  years.  They  have  driven  various  types  of  tractor- 
trailer  rigs  in  all  types  of  weather  and  at  all  times  of  the  day  and  night 
They  have  endured  bumper- to-bumper  traffic  on  plant  and  state  routes  which 
are  not  adequate  to  accommodate  this  load  of  traffic.  "Believe  it  or  not, 
none  of  these  three  drivers  has  ever  been  involved  in  a vehicle  accident 
while  on  duty.  There  is  no  written  or  memory  record  that  either  man  has 
so  much  as  dented  a fender. 

It  would  be  impossible  to  accurately  calculate  the  total  number  of 
miles  driven  by  these  three  men,  but  based  on  current  mileage  records,  the 
figure  is  estimated  to  exceed  a total  of  1,000,000  miles. 
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We  realize  the  safe  driving  record  of  these  employees  can  well  be 
termed  "a  miracle,"  because  fate  has  provided  them  immunity  from  the  wrath 
of  the  reckless  and  inattentive  drivers.  However,  each  man  can  be  worthily 
accredited  with  a personal  no-fault  driving  record. 

An  award  program  established  two  years  ago  for  professional  tractor- 
trailer  drivers  has  provided  the  incentive  for  other  drivers  to  follow  in 
the  footsteps  of  Messrs.  McPeake,  Hardison  and  Goldsmith.  Twenty-seven  of 
the  35  professional  drivers  now  employed  at  Milan  Army  Ammunition  Plant 
are  wearing  gold-plated  engraved  belt  buckles  which  were  awarded  for  ex- 
ceeding five  years  without  a vehicle  accident. 


SAFETY  SHOE  DOES  IT  AGAIN 


Ralph  Dothage  (right),  an 
employee  of  Lake  City  Army  Ammuni- 
tion Plant,  was  mowing  grass  around 
farm  machinery  with  a rotary-type 
mower.  Although  at  home,  he  had 
followed  the  Plant's  advice  and  was 
wearing  his  safety  shoes.  He 
stepped  back  and  fell  over  a wagon 
tongue.  The  first  blow  of  the  mower 
blades  hit  the  top  of  his  shoe. 

When  the  blade  came  around  again, 
it  caught  the  sole  of  his  shoe, 
ripping  a deep  gash.  The  construc- 
tion of  the  shoe  resulted  in  Dothage 
sustaining  nothing  more  than  bruised 
toes.  Once  more,  the  value  of  wear- 
ing safety  shoes  during  certain  ac- 
tivities both  on  and  off  the  job  can 
be  publicized  because  of  an  accident 
with  a happy  ending. 


3 


KNOWLEDGE  VS  DESIRE 

By  Dr.  Victor  E.  Schultze,  Jr. 


••All  pilots  are  urged  to  read  this  article.  In  capsule  form  Dr. 
Schultze  has  revealed  the  subsurface  motives  of  the  risk  taker.  In 
the  flying  business  all  too  often  the  decision  making  factor  is  "de- 
sire" instead  of  "knowledge." 


One  of  the  most  difficult  aspects  of  flight  safety  education  is 
the  conversion  of  skeptics  into  believers.  Aircraft  accidents  will 
generally  accomplish  this,  but  only  if  the  person  being  converted  is 
involved  in  the  accident  himself  or  has  a close  friend  involved  in 
one.  Needless  to  say,  this  is  the  undesirable  way. 

A pilot  must  know  where  and  how  he  is  liable  to  be  involved  in 
an  accident.  Not  just  in  relation  to  emergencies  and  other  obvious 
pitfalls,  but  in  relation  to  the  situations  and  environmental  atmos- 
pheres that  precipitate  emergencies  and  potential  accidents.  These 
are  the  subtle  and  subconscious  causes  of  accidents,  and  they  are 
the  most  heinous  of  all  the  causes  in  that  they  are  so  obvious  and 
plain,  but  yet  so  nebulous. 

We  are  all  human,  and  because  of  this,  we  share  common  failings. 
There  are  three  main  peculiarities  of  the  species  "Pilotorum  humanis" 
that  account  for  the  majority  of  aircraft  accidents.  Do  not  deny 
these  manifestations  of  human  nature,  because  you  have  them  like  the 
rest  of  our  breed.  If  you  have  not  noticed  them  by  now,  you  will 
eventually . . . 

The  first  of  these  peculiarities  is  the  fact  that  men  tend  to  be 
prouder  of  their  willingness  to  take  a chance  than  of  their  caution, 
conservation,  and  carefulness.  No  doubt  many  of  us  can  recall  flying 
in  marginal  weather  to  make  that  date  or  stretching  our  fuel  supply 
to  avoid  a refueling  delay,  or  even  attempting  hazardous  flights  in 
aircraft  we  are  not  fully  qualified  to  be  flying.  Sure,  we  all  made 
it.  From  the  stories  we  hear,  we  would  think  the  odds  are  predomi- 
nantly in  our  favor,  but  are  they?  Unfortunately,  testimony  to  the 
contrary  reposes  quietly  in  flight  safety  files  under  the  heading  of 
"Pilot  Factor." 

While  remembering  these  talks  of  daring  episodes,  how  many  can 
remember  the  times  you  have  heard  of  canceled  flights  because  of 
weather  or  of  diverting  before  reaching  the  destination  because  of 
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low  fuel?  Not  many,  I'll  wager.  Why?  Because  it  is  human  nature  to 
romanticize,  to  startle,  to  glamorize.  Flying  is  a romantic  business. 

It  is  so  because  it  is  hazardous. 

Any  profession  that  involves  hazards  over  and  above  those  encountered 
in  the  more  common  occupations  is  romantic.  Who  does  not  admire  the  bull- 
fighter, the  mountain  climber,  the  auto  race  driver?  There  is  an  undeniable 
human  tendency  to  romanticize  the  risk- taker  more  than  the  man  who  figures 
a way  to  avoid  the  risk. 

To  what  does  this  all  add  up?  Simply  this:  conservatism  and  caution 

must  compete  with  a subconscious  tendency  to  regard  these  qualities  as 
a form  of  tim.idity  unworthy  of  a pilot. 

The  second  undesirable  peculiarity  of  human  nature  is  the  fact  that 
men  tend  to  use  their  powers  of  logic  and  reasoning  to  find  justification 
for  the  things  they  want  to  do  rather  than  to  determine  what  is  best  to 
do.  In  other  words,  we  tend  to  compromise  our  better  judgment  in  favor 
of  our  desires  by  rationalizing. 

Basically  man  is  a creature  of  emotions,  feelings,  impulses,  and 
unrecognized  urges,  all  kept  under  precarious  control  by  a flimsy  bridle 
of  intelligence,  rationality  and  logic,  and  the  painful  whip  of  authority 
and  social  pressure.  Most  of  us,  when  confronted  with  a problem  invol- 
ving a conflict  between  what  we  know  we  should  do  and  what  we  would  like 
to  do,  tend  to  seek  a way  to  satisfy  our  desires  while  convincing  our- 
selves that  it  is  the  proper  thing  to  do. 

"I'd  sure  like  to  get  back  to  play  in  that  golf  tournament  this  week- 
end, but  the  weather  looks  pretty  mean,"  we  say.  "What  the  heck,  I need 
some  weather  time  anyway,  and  if  I stay  low  I probably  won't  get  any 
icing."  This  is  rationalization.  "I'd  like  to  get  home.  I know  the 
weather  is  bad  and  I shouldn't  go.  Anyway,  I need  some  weather  time. 

How  convenient.  Warm  up  the  golf  sticks,  I'm  on  my  way!" 

When  man's  basic  nature,  his  fundamental  urges  and  strong  desires  pull 
him  toward  one  decision,  and  his  education  inclines  him  toward  another,  all 
too  frequently  he  will  go  with  his  feelings. 

Now  the  third  undesirable  characteristic  of  man  is  this:  men  will 

risk  losses  out  of  all  proportion  to  possible  gains  if  they  feel  that 
through  their  skill  and  luck  they  can  probably  avoid  the  loss.  Why  do 
people  in  automobiles  attempt  to  pass  on  hills  or  blind  curves?  Why  do 
pilots  flying  a poor  landing  approach  go  on  and  attempt  to  land  when  they 
know  they  should  go  around?  They  know  better.  Why  do  they  do  it? 

Why?  Simply  because  it  is  one  of  those  undesirable  human  quirks. 

What  is  to  be  gained  and  what  is  to  be  lost?  A few  minutes'  time  in  the 
case  of  the  former,  a life  in  the  case  of  the  latter.  What  gambler  would 
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play  odds  like  that?  Still,  if  someone  asked  if  you  were  a gambler,  how 
would  you  answer? 

If  you  were  to  sit  with  a man  in  his  living  room  and  give  him  these 
situations,  he  would  tell  you  he  would  do  the  safe  thing.  But  put  him 
in  one  of  the  above  situations  and  see  what  he  does.  More  than  you 
would  expect  will  gamble.  It  is  human  nature,  and  it  comes  back  to  the 
old  conflict  of  knowledge  versus  desire. 

Being  a pilot  is  a hazardous  profession,  but  it  is  only  as  hazardous 
as  you  want  to  make  it.  Control  your  desires,  and  be  aware  of  the  traps 
human  nature  has  laid  for  you.  In  years  to  come,  remembering  what  you 
have  read  here  may  save  your  life. 


Approach/ September  1972  as  reprinted  from 
ATC  "Approach  to  Safety" 


REACTIVE  CHEMICALS  COMMITTEE 


Joe  Milner,  Safety  Director 
Holston  Defense  Corporation 
Holston  Army  Ammunition  Plant 


Many  chemical  processing  industries  can  obtain  maximum  safety  reviews 
of  the  chemical  products  they  manufacture,  handle  and  store  through  the 
efforts  of  a special  committee  set  up  to  classify  chemicals  purchased  or 
produced  in  larger  than  laboratory  quantities. 

Chemicals  are  classified  as  reactive,  nonreactive,  nonreactive 
special  or  undetermined.  In  classifying  a chemical,  the  committee  uses  a 
survey  sheet,  indicating  the  name  of  the  chemical,  the  classification  of 
the  chemical  as  to  reactivity,  the  product  and  material  number,  the 
molecular  formula,  and  the  structural  formula.  The  entire  sheet,  with  the 
exception  of  the  Health  Hazard  Section,  is  filled  in  and  approved  by  the 
committee.  Any  supporting  data  such  as  Differential  Thermal  Analysis  (DTA) 
curves,  sales  bulletins  or  other  sources  is  attached  to  the  survey  sheet 
for  filing.  After  approval,  the  forms  are  sent  to  the  Recorder  of  the 
Reactive  Chemicals  Committee,  who,  at  Holston,  is  the  Contractor  Safety 
Director . 
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Class  if icat ions 


1.  Reactive  Classification  (R) . A reactive  chemical  is  a substance 
which,  by  virtue  of  polymerization,  condensation,  explosion  or  decomposi- 
tion is  potentially  hazardous  in  mixtures  which  occur  by  design,  or  which 
may  occur  by  accident,  in  manufacturing  processes.  Chemicals  which  are 
hazardous  because  of  flammability  in  the  ordinary  sense  are  not  regarded 
as  reactive  unless  such  chemicals  in  mixtures  may  explode  under  pressure 
in  the  process  concerned.  If  the  committee  classifies  the  chemical  as 
reactive,  each  of  its  reactive  features  should  be  noted  on  the  form,  along 
with  the  references  substantiating  the  reactivity. 

2.  Nonreactive  Classification  (N) . This  classification  will  be  used 
for  all  chemicals  not  classified  as  reactive,  undetermined  or  nonreactive 
special . 

3.  Nonreactive  Special  Classification  (S).  The  nonreactive  special 
classification  is  to  be  used  for  those  chemicals  which  are  normally  non- 
reactive but  which  would  create  a hazardous  condition  with  a specific 
chemical.  The  specific  reaction  must  be  noted  and  the  resulting  specific 
hazard  must  be  noted. 


4.  Undetermined  Classification  (U).  If  the  committee  is  unable  to 
classify  the  chemical  as  either  reactive  or  nonreactive,  the  classifica- 
tion will  be  listed  as  undetermined.  The  reasons  for  this  classification 
should  be  explained  under  the  Comments  section  of  the  form. 

The  committee  reviews  a chemical  classification  at  any  time  new  in- 
formation concerning  it  comes  to  their  attention.  Members  of  the  committee 
or  others  in  the  plant  may  send  new  information  regarding  reactivity  of  a 
chemical  to  the  Recorder,  who,  after  review,  will  make  the  necessary  re- 
visions or  additions. 


The  duties  and  responsibilities  of  the  committee  can  best  be  listed 
as  follows: 

1.  Coordinate  the  classification  of  chemicals  including  the 
provision  of  a reporting  form  (Reactive  Chemical  Survey  Sheet). 


2. 

to  implement 


Audit  organization  procedures  and  controls  within  divisions 
safe  practices  with  reactive  chemicals  and  chemical  processes. 


3.  Review  and  approve  the  reactivity  classification  of  chemicals. 

4.  Disseminate  appropriate  chemical  hazard  information  to  con- 
cerned departments . 


5.  Prepare  after  each  meeting,  minutes  of  committee  actions. 
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6.  Periodically  inspect,  study,  and  review  all  materials,  exist- 
ing operations,  plant  changes  or  expansion,  and  projects  existing  or  being 
considered  for  development. 

7.  Take  whatever  action  necessary  to  report  to  the  appropriate 
division  head  findings  of  a reactive  nature  and  follow-up  to  be  sure  that 
corrective  actions  have  been  taken. 

8.  Review  any  capital  project  wherein  the  committee  should  be 
appropriately  concerned  prior  to  submission  of  the  Request  for  Job  Order 
to  management  for  approval. 

9.  Classify  all  chemicals  purchased  or  produced  in  larger  than 
laboratory  quantities  as  to  their  reactivity. 

10.  Review  all  accidental  incidents  involving  reaction  of  chemi- 
cals, formulate  recommendations  to  prevent  recurrence  and  report  the 
results  of  the  review  to  the  Plant  Manager. 

11.  Offer  consultation  service  whenever  a suspected  chemical 
hazard  exists  in  its  area  of  responsibility.  The  committee  will  also 
review  certain  accident  prevention  items  (at  the  discretion  of  the 
committee  chairman)  and  give  their  recommendations. 

12.  The  committee  will  review  for  hazard  evaluation  existing  and 
new  manufacturing  processes,  storage  facilities  and  methods  of  handling 
chemicals  and  other  materials  used.  Proposed  significant  changes  in 
manufacturing  processes,  storage  facilities  and  handling  methods  will  also 
be  reviewed  by  the  committee. 

The  Health  Hazard  section  of  the  Survey  Sheet  is  completed  by  the 
Medical  Department. 

It  is  suggested  that  the  committee  be  composed  of  a member  of  Man- 
agement, a chemical  engineer,  a chemist,  representative  of  the  Engineering 
Department,  Safety  Department  representative,  and  a representative  of 
supervision  from  each  department  or  division  that  stores,  handles  or  manu- 
factures chemicals. 
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NOISE  IN  THE  HOME 


While  most  of  us  are  concerned  with  the  exposure  of  personnel  to 
noise  sources  on  the  job,  the  use  of  convenient  and  sometimes  necessary 
appliances  constitutes  a growing  noise  problem  within  the  home. 

A study  prepared  by  Bolt,  Beranek  and  Newman  under  contract  for  the 
EPA  shows  the  sound  levels  for  30  types  of  home  appliances  and  11  types  of 
home  shop  tools.  Sound  levels  were  measured  in  dB(A)  at  a distance  of 
three  feet  from  the  appliance  and  at  a height  of  five  feet.  This  measure- 
ment position  approximates  the  location  of  the  operator's  ear  for  those 
appliances  requiring  an  operator. 

Noise  levels  in  adjacent  rooms  with  the  interconnecting  door  open  may 
be  as  much  as  10  dB(A)  less  than  the  levels  of  three  feet  or  as  much  as 
several  dB(A)  greater  than  the  3-foot  levels,  depending  upon  the  details 
of  the  installation.  For  the  appliances  that  are  used  near  the  ear  (e.g., 
an  electric  shaver),  the  noise  level  of  the  ear  may  be  as  much  as  10  dB(A) 
greater  than  the  3-foot  measurements.  See  Figure  1.* 

If  you  were  to  operate  more  than  one  noisy  small  appliance  at  once, 
it  is  easy  to  see  how  you  could  be  exposed  to  an  excess  of  85  dB(A)  in 
your  own  home . 

Eighty-five  dB(A)  is  the  sound  level  above  which  a hearing  conserva- 
tion program  should  be  in  effect  at  Army  installations  according  to  TB  MED 
251.  Take,  for  example,  a food  blender  operating  at  80  dB(A)  simultane- 
ously with  a food  waste  disposal  operating  at  80  dB(A).  The  resultant 
sound  level  is  85  dB(A). 

Figure  2*  shows,  on  the  basis  of  the  number  of  people  exposed  and  the 
extent  of  exposure,  the  speech  and  sleep  interference  and  hearing  damage 
risk  associated  with  the  various  appliances.  Hobbyists,  for  example,  who 
engage  in  the  regular  use  of  power  tools  are  accepting  a moderate  hearing 
damage  risk  if  they  do  not  wear  adequate  protection. 

Noise  is  a growing  problem  in  our  communities.  Almost  without  excep- 
tion, appliances  could  be  significantly  quieter.  Many  manufacturers  have 
been  slow  to  implement  noise  control  measures  in  the  design  of  their  ap- 
pliances. However,  in  keeping  with  the  public's  growing  awareness  of 
noise,  many  appliances  can  and  will  be  improved.  Let's  do  our  part  to 
make  people  aware  of  the  hazards  that  surround  them  at  home  as  well  as  on 
the  j ob . 


* Figures  1 and  2 were  extracted  from  Report  #NTID  300.1,  U.  S.  Environ- 
mental Protection  Agency,  Washington,  D.  C. 
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A-WEIGHTED  SOUND  LEVELS  AT  3 FT 
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FIG.l  A SUMMARY  OF  NOISE  LEVELS  FOR  APPLIANCES  MEASURED  AT 
A DISTANCE  OF  3 FT. 
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FIGURE  2 ORDER-OF-MAGNITUDE  ESTIMATES  OF  EXPOSURE  TO  HOME  APPLIANCE  AND 

BUILDING  EQUIPMENT  NOISE  EXPRESSED  IN  MILLIONS  OF  PERSON-HOURS  PER  WEEK 
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PICKUP  SANDWICHED  BY  TRUCKS 


Two  Army  civilian  employees  were  en  route  to  a work  assignment  in  a 
half-ton  pickup  truck.  The  driver  approached  the  main  gate  of  their  duty 
station,  and  slowed  to  make  a left  turn  onto  the  post. 

The  entrance  of  the  gate  was  blocked  by  a truck-trailer  unloading 
gravel.  The  driver  saw  another  truck-tractor  approaching  from  the  south 
with  his  right  turning  signal  flashing.  The  Army  driver  thought  the  on- 
coming truck  was  going  to  enter  the  construction  area  and  pull  behind  the 
truck  that  was  blocking  the  entrance.  The  Army  civilian  driver  made  a left 
turn  in  front  of  the  approaching  truck-tractor , which  continued  straight 
ahead  instead  of  turning. 

The  truck-tractor  struck  the  pickup  in  the  side,  bouncing  it  against 
and  partially  under  the  parked  truck-trailer.  Photo  1 shows  the  final 
resting  place  of  the  Army  pickup  truck  and  damage  to  the  parked  vehicle. 
Photo  2 shows  the  extent  of  damage  to  the  truck  that  struck  the  pickup. 


Photo  1 


Photo  2 


Both  the  driver  of  the  Army  pickup  and  his  passenger  suffered  multiple 
fractures  and  lacerations.  Damage  to  the  Army  vehicle  was  estimated  at 
$2,396,  and  the  commercial  vehicles  sustained  a combined  damage  of  $10,800. 

Contributing  factors  to  the  accident  were: 

1.  No  traffic  controls  had  been  established  to  warn  motorists 
that  construction  work  was  in  progress. 

2.  There  were  no  warning  signs  or  flagmen  in  the  area. 

3.  The  area  was  heavily  congested  with  construction  equipment 
and  other  vehicles. 

4.  The  driver  of  the  Army  vehicle  disregarded  traffic  laws  by 
failing  to  yield  the  right-of-way. 

Warning  signs  or  flagmen  will  be  placed  at  construction  areas  in  the 
future.  Also,  continued  effort  will  be  made  to  caution  operators  of 
Government  vehicles  to  exercise  extreme  caution  while  driving. 


OVERTURNING  FORKLIFT  PINS  OPERATOR 

A forklift  operator  was  transporting  palletized  material  from  one 
location  to  another  with  a 4,000-pound  capacity  forklift  truck. 

The  operator  was  making  a right  turn  when  the  right  front  tire  of  the 
forklift  truck  hit  a concrete  barricade  that  guarded  a fire  hydrant.  This 
cau,  ^d  the  forklift  to  overturn.  The  operator  was  pinned  across  his 
shoulders  and  neck  by  the  overhead  guard.  Fellow  employees  lifted  the 
forklift  off  the  injured.  He  suffered  chest  and  cervical  spine  fractures. 

No  mechanical  defects  could  be  found. 

The  operator  was  cited  for  failing  to  maintain  a proper  lookout,  and 
being  inattentive  to  operating  responsibilities. 

He  was  to  be  removed  from  the  forklift  operation  detail,  and  attend  a 
forklift  operator  remedial  and  refresher  training  course  before  being  re- 
assigned to  similar  tasks. 
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JUST  A LITTLE  BIT  OF  PRIMER  MIX 


An  operator  had  finished  his  charging  production  assignment  for  the 
work  shift  and  was  preparing  to  remotely  dump  the  remaining  three  to  four 
ounces  of  dry  primer  mix  into  a non-conductive  salvage  cup.  When  removed, 
the  contents  of  the  salvage  cup  are  immersed  in  water  for  disposal. 

As  he  positioned  himself  to  dump  the  remaining  dry  mix,  he  noticed 
the  salvage  container  was  out  of  position.  He  opened  the  side-barricaded 
cubicle  door,  held  it  open  with  his  left  hand  and  pushed  the  salvage  con- 
tainer into  proper  position  with  his  right  hand.  The  explosion  occurred  at 
this  point. 

The  operator  suffered  a minor  laceration  of  the  forehead.  The  equip- 
ment was  severely  damaged,  and  some  damage  was  done  to  the  blow-out  walls 
and  other  facilities.  Estimated  property  damage  was  $2,680. 

Established  procedures  for  malfunction  inside  the  cubicle  are: 

1.  Inform  supervisor  of  the  unusual  occurrence.  (Employee  had 
reported  the  salvage  cup  being  out  of  position  twice  during  his  work  shift. 
The  supervisor  planned  to  make  necessary  adjustments  after  the  area  was 
completely  decontaminated  at  the  end  of  the  shift.) 

2.  Dump  the  remaining  powder  into  a rubber  bucket  containing 
three  gallons  of  water. 

3.  Operate  the  deluge  system  to  completely  wet  down  all  existing 
powder  inside  the  cubicle. 

The  operator  failed  to  follow  instructions  when  he  repositioned  the 
salvage  cup,  since  these  cups  are  never  to  be  moved  from  their  position 
after  the  machine  hopper  has  been  charged. 

No  exact  cause  of  the  accident  was  established,  except  that  the  op- 
erator entered  the  cubicle  when  explosives  were  present  and  repositioned 
the  salvage  cup  with  his  hand. 

Corrective  actions  to  preclude  recurrence  of  such  an  incident  are  as 
follows : 


1.  An  engineering  revision  will  be  made  to  eliminate  possible 
misalignment  of  the  salvage  cup  on  the  dumping  fixture. 

2.  An  additional  mirror  will  be  provided  inside  of  and  to  the 
rear  of  the  charging  unit  for  improved  observation  of  the  operation  through 
the  view  port. 
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3.  Operators  will  be  reinstructed  to  inform  supervision  of  any 
unusual  occurrences  to  units  inside  the  cubicles. 

4.  Daily  inspections  of  all  remote  controlled  units  prior  to 
insertion  of  explosives  will  be  established.  An  inspection  of  a "dry  run" 
is  to  be  conducted  by  responsible  persons. 


FIRING  PIN  FIRES  DETONATOR 


A routine  Government  Acceptance  Test  was  being  performed  on  M57E1 
detonators.  The  inspector  was  in  the  process  of  inserting  the  firing  pin 
into  the  assembly  when  the  detonator  exploded.  He  suffered  partial  ampu- 
tations of  his  left  thumb  and  forefinger,  a severe  laceration  of  his  left 
middle  finger,  and  a large  bruise  on  his  right  thumb.  There  was  no 
property  damage. 

The  established  procedure  consisted  of  preparing  an  assembly  of  a 
detonator,  an  aluminum  sleeve,  a plastic  holder  and  a metal  witness  block 
(disc).  This  assembly  is  then  placed  in  a die  inside  the  drop-test 
machine.  This  unit  is  then  rotated  90°  from  its  vertical  position  to  a 
horizontal  position.  After  a firing  pin  is  inserted  into  the  assembly, 
the  drop-ball  is  then  positioned  on  the  magnet.  The  door,  which  serves  as 
a guard,  is  then  closed.  Ensuingly,  the  assembly  is  returned  to  its 
original  vertical  position.  The  drop-ball  is  released  which  drives  the 
firing  pin  into  the  detonator,  thus  causing  the  explosive  functioning. 

Observations  made  by  investigators  were  as  follows: 

1.  The  injured  man  was  holding  the  test  assembly  with  his  left 
hand  as  he  inserted  the  firing  pin  with  his  right  hand.  The  pin  insert- 
ing operation  does  not  require  the  use  of  the  left  hand;  however,  the  op- 
erator stated  that  he  occasionally  used  his  left  hand  but  could  give  no 
reason  why  he  did  so. 

2.  All  safety  devices  were  in  good  condition;  i.e.,  guards, 
finger  stop,  test  holder  unit,  etc. 

3.  The  firing  pin  cannot  be  inserted  too  deeply  if  the  test 
assembly  is  in  the  complete  horizontal  position  due  to  the  position  of  the 
"finger"  stop  block. 

4.  Posted  job  rules  and  procedures  are  current,  correct  and 
readily  available. 
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5.  The  injured  had  been  thoroughly  instructed,  and  had  been  a 
fuze  tester  for  approximately  nine  years  and  had  not  experienced  any  pre- 
vious incidents  of  this  nature. 

It  was  concluded  that  the  operator  may  have  used  his  left  hand  to 
hold  the  test  assembly  when  inserting  the  firing  pin  instead  of  using  the 
"Finger  Stop  Block"  as  required  by  the  standing  operating  procedure.  It 
was  also  suspected  that  the  firing  pin  was  inserted  at  some  position  other 
than  with  the  assembly  in  the  horizontal  position. 

The  following  recommendations  were  made  to  prevent  recurrence  of  this 
type  of  accident: 

1.  Discontinue  the  manual  insertion  of  firing  pins  from  within 
the  drop-test  unit.  Use  the  two  available  detonator  test  units  which  per- 
mit insertion  of  the  firing  pin  from  outside  of  the  unit. 

2.  Redesign  the  other  machines  to  allow  insertion  of  the  firing 
pin  from  outside  the  guarded  machine  for  testing  boosters  and  detonators. 

3.  Investigate  the  possibility  of  fabricating  a completely  new 
type  testing  unit  and/or  method. 

4.  Schedule  weekly  "check-out"  by  foremen  for  each  employee  with 
special  emphasis  on  rigidly  adhering  to  established  procedures  and  job  in- 
structions . 

5.  Publicize  accident  factors  throughout  the  installation. 

‘sV'/V'sWf* 

LADDER  SLIPPED,  WORKER  FLIPPED 

A utilityman  had  been  assigned  the  task  of  removing  paper  lining  from 
the  interior  of  a commercial  boxcar. 

He  used  a 7-foot  ladder  that  was  not  equipped  with  safety  shoes.  The 
floor  of  the  boxcar  was  metal.  It  was  dry,  but  slippery,  due  to  continued 
use . 


When  the  man  had  climbed  approximately  five  rungs,  the  ladder  slipped 
causing  him  to  fall  to  the  floor  of  the  boxcar.  He  suffered  a fractured 
left  wrist. 

To  prevent  future  accidents  of  this  type,  new  8-foot  step  ladders  with 
safety  shoes  will  be  provided  for  men  assigned  to  work  in  boxcars.  In  addi- 
tion, the  incident  was  discussed  in  group  safety  meetings  by  all  foremen. 
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PRESSURE  TANK  EXPLOSION  — LIQUID  NITROGEN  SYSTEM 


Summary 

At  an  AEG  contractor  facility,  a vertical,  mild  steel  tank  (24" 
diameter  X 60"  high,  and  weighing  approximately  135  pounds)  became  over- 
pressurized, ruptured,  and  was  propelled  approximately  150  feet  into  the 
air.  It  came  to  rest  on  the  roof  of  a building  some  75  feet  from  the 
location  where  it  had  been  installed.  The  tank  was  being  used  as  a surge 
tank  in  a laboratory  liquid  nitrogen  system,  which  was  designed  to  provide 
pure  nitrogen  to  the  second  stage  of  a 6-stage,  10,000  psi  compressor  for 
an  18- inch  hypersonic  wind  tunnel. 

The  force  exerted  by  the  overpressurization  blew  the  welded  concave 
bottom  completely  out  of  the  tank;  pulled  a ^-inch  anchor  bolt  from  its 
concrete  foundation;  twisted  the  heavy  angle  iron  base  on  which  the  tank 
was  seated,  and  scattered  the  piping  over  the  confined  yard  area. 

There  were  no  injuries  and  property  damage  was  slight.  The  only  loss 
was  the  tank,  associated  piping,  and  a small  hole  which  was  punched  in  the 
roof  of  the  building.  However,  the  incident  had  the  potential  for  result- 
ing in  multiple  serious  or  fatal  injuries  and/or  extensive  property  damage. 


Cause  of  the  Incident 

Investigation  showed  that  the  system,  which  had  been  operating  in  its 
present  condition  for  less  than  six  months,  had  been  installed  with  an  un- 
marked pressure  surge  tank  which  had  no  pressure  relief  valve  or  rupture 
disc.  A pressure  relief  valve  had  been  installed  in  the  piping  approxi- 
mately 30  feet  from  the  tank;  but  two  solenoid  valves  which  had  been  in- 
stalled between  this  relief  valve  and  the  surge  tank  had  isolated  the  tank 
from  any  safety  relief  protection. 

A regulator  had  been  installed  in  the  nitrogen  supply  line  between 
the  vaporizers  and  the  surge  tank;  however,  because  of  downstream  losses 
in  the  line  and  the  fact  that  the  installed  regulator  was  undersized,  the 
regulator  had  been  opened  to  almost  its  full  capacity  to  provide  the  nec- 
essary 30  psig  for  the  compressor.  The  using  organization,  while  aware 
that  the  regulator  was  undersized,  had  continued  to  operate  the  system  by 
manipulating  the  regulator  rather  than  shutting  it  down  pending  installa- 
tion of  a regulator  which  would  provide  the  necessary  flow  at  a proper 
setting . 

When  the  compressor  would  automatically  shut  down,  the  solenoid  valves 
in  the  line  would  close;  and  without  flow,  the  pressure  in  the  surge  tank 
(which  was  designed  for  50  psig  maximum  allowable  working  pressure)  would 
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increase  to  80  to  100  psig.  This  increase  in  pressure  was  caused  by  the 
fact  that  the  undersized  regulator  was  at  a setting  during  flow  which  ap- 
proximated 100  psig  during  static  conditions. 

The  using  organization  stated  that  they  were  under  the  impression 
that  the  surge  tank  had  been  designed  for  a working  pressure  compatible 
with  the  system  and  were,  therefore,  unconcerned  about  this  pressure  rise. 


Recommendations 


The  importance  of  having  all  pressure  systems  properly  designed,  in- 
stalled, and  maintained  and  the  need  for  stringent  safety  procedures  for 
their  operation,  even  when  only  a few  pounds  of  pressure  are  involved, 
cannot  be  too  strongly  emphasized.  For  this  reason,  it  is  recommended 
that  any  type  of  pressure  of  vacuum  equipment  receive  a thorough  inde- 
pendent review  by  a member  of  the  safety  group  prior  to  startup  and  prior 
to  modifications  to  existing  equipment.  If  any  questionable  safety  aspects 
arise  after  the  equipment  is  put  into  use,  the  operation  should  be  shut 
down  and  the  line  supervisor  should  enlist  the  help  of  the  appropriate 
member  of  the  safety  group. 


- Serious  Accidents,  Issue  No.  328 
19  July  1972 

Division  of  Operational  Safety 
US  Atomic  Energy  Commission 
Washington,  D.  C.  20545 

IT’S  SNOW  TIME  AGAIN!  (Cont  from  page  1 ) 

• Think  over  the  techniques  of  driving  on  snow  and  ice.  NEVER  slam  on 

the  brakes  I When  you  have  to  stop,  let  up  on  the  gas  slowly  and  pump  the 

brakes  gently  --  that  means  start  stopping  long  before  you  get  to  an 
intersection,  and  as  soon  as  you  realize  you  may  have  to  stop  for  any 
other  reason.  As  you  approach  an  intersection,  watch  it  1 The  fellow  ap- 
proaching from  your  right  or  left  may  not  be  able  to  stop  before  sliding 
on  out  into  your  path. 

•If  you  should  go  into  a skid,  turn  the  wheels  in  the  direction  of  the 
skid  and  slowly  let  up  on  the  gas.  Above  all,  don't  panic  I 

Yes,  you've  heard  all  these  things  over  and  over  again.  And  you'll 
probably  hear  them  all  again  next  winter,  and  the  next.  But  isn't  that 

what  safe  driving  is  all  about  --  knowing  exactly  what  to  do  in  an  emer- 

gency --  and  not  having  to  stop  and  think,  "Oh  gosh,  I'm  going  into  a skid 
and  this  is  glare  ice  I Now  what  was  it  I heard  that  time  five  or  six  years 
ago  about  what  to  do  when  this  happens?" 
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THE  SAFETY  GAP 


Edward  M.  Klinghoffer 
Safety  Engineer,  Picatinny  Arsenal 


Today,  when  we  speak  of  science  and  technology  racing  ahead  of  us,  we 
sometimes  forget  that  this  problem  has  been  around  ever  since  man  started 
thinking  of  new  ways  for  doing  things . 

We  should  remember  that  it  took  5,000  years  from  the  time  man  first 
learned  to  ride  on  horses  until  the  time  that  man  first  developed  a safety 
device  for  this  practice.  This  device,  invented  during  the  Middle  Ages, 
was  called  the  saddle.  A seemingly  obvious  idea  certainly  took  a surpris- 
ing amount  of  time  to  develop. 

For  another  example,  let  us  look  at  ships.  Before  the  dawn  of  re- 
corded history,  man  built  and  sailed  on  ships.  Yet  ships  were  not  commonly 
equipped  with  life  boats  until  the  19th  century.  You  may  recall  that 
there  were  only  enough  life  boats  for  half  of  the  passengers  and  crew  of 
the  Titanic  when  she  sank  in  1912. 

In  the  case  of  the  railroad  industry,  it  was  more  than  one  hundred 
years  after  the  steam  locomotive  was  first  used  for  transportation  that 
George  Westinghouse  invented  the  air  brake  to  stop  railroad  trains  safely. 
Supposedly,  the  source  of  his  inspiration  was  a disastrous  train  wreck 
which  was  reported  in  the  newspapers  of  the  time. 

Another  example  would  be  the  airplane.  Although  the  airplane  was 
finely  developed  as  a combat  weapon  during  World  War  I,  it  was  not  until 
some  time  after  the  war  was  over  that  the  parachute  was  perfected  and 
widely  used.  Many  lives  were  lost  needlessly  as  a result. 

"Well,"  you  say,  "what  about  the  automobile?  That  is  the  form  of 
transportation  that  I use  every  day." 

It  has  been  50  years  since  automobiles  came  into  common  use  on  the 
streets  and  highways  of  this  country.  Yet  even  today,  safety  devices  have 
not  been  perfected  to  completely  protect  the  motor  vehicle  driver  or  his 
passengers  from  injury  in  a collision.  All  that  we  can  do,  is  to  use  the 
safety  devices  that  are  available  at  the  present  time. 

Many  examples,  similar  to  those  we  have  discussed,  can  be  found  in 
every  field  of  scientific  development.  It  is  a challenge  to  the  safety 
profession  to  close  the  "safety  gaps"  as  they  occur  in  new  technologies 
and  to  teach  people  to  protect  themselves  until  these  gaps  are  closed. 

Only  in  this  way,  can  we  learn  to  live  with  the  rapid  technical  advances 
that  are  so  much  a part  of  our  lives  today. 


19 


SELLING  SAFETY  IS  AN  EASY  JOB 


Tommy  Bales,  Leader 
Remington  Arms  Co.,  Inc. 
Lake  City  Army  Ammunition  Plant 


Before  coming  to  work  here  at  Lake  City  I was  a salesman;  seems  like 
I can't  get  out  of  the  habit  of  selling,  because  today  I'd  like  to  sell 
you  something.  It  is  something  that  is  guaranteed  to  be  the  best  on  the 
market,  and  something  which  every  one  of  you  can  see. 

That  something  is  safety. 

Safety  is  cheap:  it  is  something  that  everyone  can  afford  because  it 

costs  only  a second  of  your  time,  a second  in  which  to  stop  and  think  and 
be  careful.  There  are  86,400  seconds  in  24  hours  and  surely  each  of  us 
can  afford  to  spare  a few  of  those  for  safety. 

Safety  is  easy  to  get:  you  don't  have  to  write  a letter  and  order 

it;  you  don't  even  have  to  walk  to  the  corner  drug  store  to  get  it;  it  is 
with  you  all  the  time;  all  you  have  to  do  is  use  that  one  short  second  to 
buy  all  you  need. 

Safety  is  durable:  you  can  use  it  every  day,  at  home  and  on  the  job, 

and  it  will  never  wear  out;  it  will  always  be  with  you  ready  to  be  used 
again  the  next  time  you  need  or  want  it. 

And  safety  is  convenient  to  use:  it  doesn't  have  to  be  unwrapped, 

unpacked,  heated  or  chilled;  safety  is  ready  for  use  whenever  you  are 
ready  to  use  it;  all  you  have  to  do  is  take  one  tiny  second  to  stop,  think 
and  be  careful. 

These,  then,  are  the  four  points  in  my  safety  sales  talk: 

1.  Safety  is  cheap  --  much  cheaper  than  a few  days  or  weeks  in  a 

hospital . 

2.  Safety  is  easy  to  get  --  much  easier  to  get  than  a broken  arm 

or  leg. 

3.  Safety  is  durable  --  much  more  so  than  an  artificial  limb. 

4.  Safety  is  convenient  --  a lot  more  convenient  than  using  a 
cast  or  bandage. 

So  don't  wait,  don't  hesitate,  buy  safety  today.  Buy  the  large 
economy  size;  it  doesn't  cost  a bit  more. 
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And,  you  might  try  being  a salesman  too.  Sell  some  safety  to  your 
friends  and  families.  They  can  use  it. 


Editor's  Note:  This  is  a reprint  of  a talk  made  in  an  employee 

safety  meeting  by  Mr.  Bales  and  subsequently  published  in  the 
December  1951  issue  of  the  "Lake  City  Tracer",  Lake  City  Array 
Ammunition  Plant,  Independence,  Missouri. 


ZERO  IN  ON  PROMOTING  SAFE  PARTICIPATION 
IN  SPORTS  AND  RECREATION 


Webster's  New  World  Dictionary  defines  promotion  as  the  stirring  up 
of  interest  in  an  enterprise.  As  a safety  professional,  do  you  accept 
this  definition  at  face  value  and  stop  there?  Is  your  safety  promotional 
effort  restricted  to  only  "stirring  up  interest"? 

A safety  director's  need,  his  requirements,  for  promotion  go  much 
further  than  that.  To  him  promotion  is  a means  to  an  end,  a method  of 
achieving  a result.  Promotion  must  encompass  more  than  stirring  up  or 
stimulating  interest.  Promotion  must  influence  behavior  and  promotion 
must  prompt  or  provoke  a desired  action.  Promotion  to  the  safety  director 
must  yield  results. 

Too  much  emphasis  has  been  given  to  the  embellishment  of  safety  pro- 
motion --  to  the  "window  dressing"  or  ornamentation  --  to  the  posters  and 
pamphlets  and  attention-getting  gimmicks.  This  decoration  plays  its  part, 
but  decoration  must  not  serve  as  the  entire  promotional  program.  Handouts, 
pamphlets,  posters  and  displays  play  a role  in  influencing  employee 
behavior,  but  too  often  our  promotional  emphasis  stops  there.  The  safety 
professional  needs  to  actively  influence  behavior,  not  just  hope  a poster 
message  soaks  ini  Anything  we  can  do  to  influence  employee  action  toward 
the  desired  results  must  be  used  in  promotion. 

Recent  safety  emphasis  within  AMC  has  been  directed  toward  reducing 
the  number  and  severity  of  sports  and  recreation  accidents.  Let's  apply 
the  above  broad,  professional  idea  of  safety  promotion  toward  promoting 
sports  and  recreation  safety.  In  addition  to  posters,  displays,  handouts 
and  pep  talks,  let's  see  what  can  be  done  to  stimulate  safety  participa- 
tion in  sports  and  recreational  activities. 
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The  safety  director,  supervisor,  coach  or  company  commander  knows 
that  the  cooperation  and  support  of  sports  participants  in  performing 
safely  are  necessary.  Self-responsibility  must  be  developed  in  partici- 
pants so  the  activity  will  be  performed  safely  whether  at  Army- sponsored 
special  services  athletic  events  or  at  spontaneous  and  impromptu  "sand-lot" 
games . 

Promoting  safe  attitudes.  Most  people  will  obey  rules  they  under- 
stand. On  the  other  hand,  usually  they  will  not  obey  rules  they  do  not 
understand  or  do  not  see  the  need  for.  The  participants  should  not  be 
simply  presented  a list  of  "do's"  and  "don't's"  prescribing  safe  and 
dangerous  behavior  without  the  logic  behind  the  rules. 

Most  participants  will  obey  safety  rules  if  they  are  convinced  the 
rules  are  a prerequisite  for  participation.  Safety  rules  should  be 
strictly  enforced  and  the  value  of  the  rules  in  increasing  the  enjoyment 
of  the  sport  should  be  emphasized.  Coaches,  supervisors.  Commanders,  etc., 
also  can  help  develop  participants'  respect  for  safety  rules  by  setting 
good  examples. 

Promoting  self-discipline.  Participants  must  learn  to  govern  them- 
selves in  their  own  best  interests.  External  authority  and  control 
will  not  always  be  present.  In  order  to  develop  personal  responsibility 
for  safe  performance,  participants  must  be  given  opportunities  to  plan, 
execute,  and  evaluate  their  own  performance  and  conduct.  One  method  of 
accomplishing  this  is  to  have  participants  assist  in  developing  a safety 
code  and  safety  rules.  Participants  should  also  be  encouraged  to  assist 
in  enforcing  safety  codes  and  rules.  Participants  might  be  assigned 
responsibilities  for  inspecting  equipment  and  facilities,  helping  beginners 
learn  basic  skills,  and  supervising  certain  sports  activities. 

Promotion  through  the  basic  laws  of  learning.  We  must  promote  the 
safe  way  to  perform  various  athletic  skills  rather  than  employ  the  method 
of  having  participants  "learn"  how  to  avoid  accidents  by  first  suffering 
accidents.  The  basic  laws  of  learning  can  be  successfully  used  in  the 
promotion  of  safe  performance  of  sports  activities: 

1.  Law  of  Use  --  The  more  a basic  skill  is  practiced,  the  more 
proficient  the  individual  becomes. 

2.  Law  of  Disuse  --  If  a skill  is  not  performed  for  a certain 
length  of  time,  proficiency  will  decrease. 

3.  Law  of  Effect  --  Skills  that  are  satisfying  will  be  repeated, 
while  annoying  skills  will  be  avoided. 

4.  Law  of  Primacy  --  First  experiences  are  more  likely  to  be 
remembered  than  later  ones . 
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5.  Law  of  Recency  --  Recent  experiences  are  more  likely  to  be 
remembered  than  remote  ones . 

Promotion  through  the  use  of  basic  human  needs.  Self-preservation  is 
perhaps  the  most  basic  human  drive.  Emphasis  in  safety  promotion  should 
be  placed  on  avoidance  of  injury  rather  than  avoidance  of  the  accident 
itself.  Participants  will  be  quick  to  accept  safety  practices  when  they 
realize  an  injury  will  prevent  them  from  participating. 

Safety  promotion  should  stress  the  importance  of  each  individual's 
contribution  to  the  group  effort.  An  injured  player  cannot  contribute  to 
the  group,  and  each  individual  strives  for  group  acceptance  by  contribut- 
ing to  the  goals  of  the  group. 

Most  persons  desire  responsibility  as  a form  of  recognition.  Indi- 
vidual participants  should  be  delegated  as  much  safety  responsibility  as 
they  are  capable  of  handling.  Promotion  should  emphasize  the  need  for 
assuming  self-responsibility. 

Personal  pride  can  be  used  to  promote  safety  by  having  outstanding 
players  demonstrate  the  safe  way  to  perform  specific  skills  and  exercises. 
Other  participants  will  be  more  likely  to  accept  safety  practices  if  they 
see  that  the  outstanding  players  practice  them. 

Individual  and  group  safety  competition  can  be  generated  and  main- 
tained by  rewarding  individuals  and  groups  who  have  accident  and  injury- 
free  records . 

Additional  promotion  methods.  There  are  several  additional  major 
methods  of  promotion  which  can  be  advantageously  employed  in  developing 
safety  practices  in  sports  and  recreational  activities: 

1.  Demonstration  --  Demonstration  is  the  basic  method  used  in 
developing  skill,  and  any  satisfactory  method  of  developing  skill  is  a 
method  of  promoting  safety  since  the  proper  way  to  perform  a skill  is  also 
the  safe  way. 

2.  Imitation  and  practice  --  After  observation  of  a skill 
demonstration,  participants  should  practice  the  skill.  Coaches  and  super- 
visors should  observe  each  individual  and  correct  any  mistakes  in  execu- 
tion. 


3.  Army  Extension  Course  --  Subcourse  #45,  Safety  in  Physical 
Training,  Sports  and  Recreation,  outlines  the  fundamentals  in  preventing 
accidents  and  injuries  while  participating  in  sports  and  recreation. 
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HOW  TO  BLOW  UP  A PLANT  WITHOUT  DAMAGING  IT 


M.  J.  Reynolds,  Explosives  Manager 
Uniroyal,  Inc.,  Joliet  Army  Ammunition  Plant 


My  subject  for  today  sounds  impossible,  doesn't  it?  Really,  my 
discussion  will  center  around  the  Carmody  Universal  Process  Trainer  that 
we  have  selected  for  use  at  Joliet  Army  Ammunition  Plant.  It  has  been 
specifically  selected  and  obtained  for  use  in  preparation  for  start-up  of 
the  three  new  modern  acid  facilities  and  the  three  continuous  TNT  lines 
presently  under  construction.  Potential  of  this  unit  is  not  limited  to 
the  modern  facilities,  however.  Its  flexibility  makes  it  possible  to  set 
up  any  chemical  operation  within  the  plant  and  assimilate  it  within  a 95% 
to  1007o  accuracy  tolerance. 

Because  training  by  simulator  allows  operators  to  "blow  up"  a plant 
any  number  of  times  while  in  training,  they  are  less  likely  to  do  so  when 
it  counts . 

The  column's  temperature  indicator  began  to  rise.  "A  triviality," 
thought  the  operator  as  he  adjusted  the  control  valve.  But  the  indicator 
continued  to  climb.  In  addition,  the  fuel  supply  pressure  indicator  began 
curving  upward.  "I  don't  remember  any  relationship  between  these  two  in- 
dicators," the  operator  muttered  as  he  twisted  the  pressure  knob.  Now  the 
temperature  and  pressure  were  shooting  up.  "I'd  better  open  the  valve  in 
the  relief  line,"  the  operator  gasped.  But  it  was  too  late.  "You  just 
blew  up  the  plant,"  his  supervisor  scolded  --  and  then  laughed.  Everyone 
else  in  the  room  joined  in.  They  were  laughing  only  because  the  operator 
had  been  operating  the  panel  instruments  of  a process  training  simulator, 
and  not  of  an  actual  plant. 
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What  Is  A Process  Simulator? 


Basically,  a process  simulator  is  an  electro-mechanical  medium  for 
two-way  communication  between  an  instructor  and  a trainee  being  taught  the 
intricacies  of  controlling  a chemical  process . 

Physically,  it  consists  of  three  main  parts: 

1.  A graphic  display  panel. 

2.  A main  instrument  panel. 

3.  A control  console. 

Among  the  accessories  are  interchangeable  instrument  modules , program 
boards,  alarms  and  connecting  cables. 

Trainees  depict  the  process  they  are  to  study  by  means  of  equipment 
symbols  and  flowlines,  which  attach  magnetically  to  the  graphic  panel. 

This  not  only  helps  them  learn  the  relative  location  and  relationship  of 
the  process  components,  it  accelerates  their  understanding  of  the  opera- 
tion. During  training  sessions,  the  display  panel  also  serves  as  a ready 
reference  for  flows,  control  locations,  and  equipment  configurations. 

Modular  construction  enables  the  instructor  to  change  from  one  process 
to  another  in  a matter  of  minutes.  The  actual  control  panel  for  any 
process  can  be  accurately  copied  with  the  interchangeable  instrument 
modules  and  fixed  multipoint  indicator. 

Trainees  set  up  the  easily  mastered  program  boards  from  appropriate 
drawings.  Instruments  can  be  operated  automatically  through  these  boards 
to  show  instrument  relationships  and  alarm  functions,  or  they  can  be  op- 
erated individually  from  the  control  console.  Malfunctions  and  emergencies 
can  be  introduced  automatically  through  the  program  board,  or  by  the  in- 
structor directly  from  the  control  console. 

Trainees  learn  by  doing,  with  guidance  from  the  instructor  as  he,  from 
the  control  console,  sets  up  normal  and  emergency  process  conditions  on 
the  simulator.  Whereas  the  instructor  improvises,  the  relationships  pre- 
viously set  up  on  the  program  board  occur  automatically. 

The  trainee's  responses  provide  immediate  feedback,  which  enables  the 
instructor  to  regulate  the  pace  of  training  for  maximum  effectiveness. 

The  instructor  changes  output  signals,  alters  process  variables,  sets  off 
alarms,  causes  motors  to  fail  and  simulates  malfunctions  to  create 
realistic  control  room  circumstances. 
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Advantages  of  Training  by  Simulation 


An  operator  may  experience  only  a few  emergencies  in  his  entire  life. 
When  he  is  trained  by  simulation,  however,  he  can  go  through  a dozen 
emergencies  in  a single  day.  Unlike  conventional  training,  training  by 
simulation  is  almost  as  real  as  experience. 

Training  by  simulation  enhances  versatility.  Most  conventionally 
trained  operators  know  only  how  to  operate  a single  process.  By  means  of 
simulation,  however,  an  operator  can  be  prepared  to  perform  a variety  of 
operating  tasks  in  addition  to  his  regular  assignment. 

Much  conventional  training  involves  learning  by  rote.  Consequently, 
many  operators,  even  those  who  have  had  on-the-job  training,  only  know, 
for  instance,  that  a certain  valve  must  be  opened  when  a particular  gage 
indicator  reaches  a specific  point,  but  they  never  learn  why.  On  the 
other  hand,  whether  the  training  is  basic,  intermediate  or  advanced,  train 
ing  by  simulation  ensures  that  operators  acquire  a depth  of  knowledge  not 
possible  with  other  training  methods. 

Faced  with  a sudden  emergency,  the  s imulator- trained  operator  is  more 
likely  to  handle  emergencies  with  confidence  because  he  will  have  en- 
countered more  of  them  than  an  ordinary  operator  with  years  of  experience. 

Training  by  simulation  gives  operators  a chance  to  demonstrate  their 
knowledge  and  skill,  an  opportunity  generally  absent  in  conventional 
methods.  As  a trainee  progresses,  his  desire  increases  for  more  knowledge 
and  he  is  motivated  to  work  out  problems  and  procedures  on  the  simulator. 

Good  motivation  implies  high  morale.  A well-trained  operator  enjoys 
greater  job  security.  He  also  appreciates  the  importance  of  doing  his 
tasks  well.  He  knows  that  his  efficiency  means  fewer  unscheduled  shut- 
downs, shorter  turnarounds  and  higher  quality  product. 

Documented  experiences  of  major  industries  of  the  world  have  found 
profitable  applications  for  the  Carmody  training  approach.  One  large 
corporation  is  reputed  to  have  17  simulators  integrated  into  its  manufac- 
turing department. 

As  a Safety  Committee,  one  of  the  more  important  statistics  would  be 
to  claim,  "facility  unharmed  while  plant  is  destroyed  three  times  on 
trainer . " 

Some  of  the  reasoning  supporting  our  decision  to  go  this  route  can  be 
outlined  as  follows: 
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1.  First,  the  technological  changes  in  the  chemical  industry 
have  led  to  highly  instrumented  equipment  and  larger  process  units  where 
operator  mistakes  can  be  extremely  costly. 

2.  The  industry  has  become  highly  competitive  making  it  essen- 
tial that  every  employee  is  utilized  to  the  maximum  of  his  ability. 

3.  The  type  of  labor  available  has  changed.  Previously,  un- 
skilled labor  of  reasonable  caliber  was  satisfactory;  this  is  no  longer 
the  case.  We  can,  however,  develop  proper  aptitudes,  people  with  slightly 
less  than  a high  school  education,  into  satisfactory  operators  with  this 
instruction  and  their  cooperation. 


ANNISTON  ARMY  DEPOT 

WINS  NATIONAL  SAFETY  COUNCIL  AWARD  OF  HONOR 


Anniston  Army  Depot  was  the  recent  recipient  of  a National  Safety 
Council  Award  of  Honor  for  operating  more  than  5,500,000  man-hours 
without  a disabling  injury.  Shown  admiring  the  award  plaque  are 
COL  M.E.  Rice,  Commanding  Officer;  Faye  Richey,  Civilian  Personnel 
Division;  and  Ginger  Fair,  Lance  Fueling  Facility. 


27 


Here  are  ten  questions  that  will  test  your  knowledge  of  safety  re- 
quirements that  you  will  need  under  different  circumstances.  Answers  to 
these  questions  may  be  found  in  the  AMCR  385-series,  the  AR  385-series  and 
the  AMC  Supplements  to  the  AR  385-series.  How  many  can  you  answer  without 
referring  to  the  regulations? 


1.  What  immediate  action  must  be  taken  by  the  safety  director  when  an 
accident  occurs  at  his  installation? 

Answer  and  reference: 

2.  VThat  are  the  approved  lightning  protection  systems  for  use  at  an  AMC 
installation? 

Answer  and  reference: 

3.  What  basic  procedures  should  be  followed  as  pertains  to  materials 
handling? 

Answer  and  reference: 

4.  Is  heating  of  explosives  storage  magazines  ever  permitted? 

Answer  and  reference: 

5.  What  factors  are  considered  when  grouping  ammunition  and  explosives 
for  compatibility? 

Answer  and  reference: 

6.  Of  what  does  a thorough  fire  inspection  consist? 

Answer  and  reference: 
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7.  For  accident  reporting  purposes,  what  constitutes  an  "Explosive  Ac- 
cident?" 

Answer  and  reference: 

8.  What  is  the  procedure  for  AMC  installations  and  activities  to  follow 
in  submitting  the  monthly  DA  Form  2398? 

Answer  and  reference : 

9.  What  are  the  requirements  for  explosives  plant  clothing;  i.e.,  powder 
uniforms  ? 

Answer  and  reference: 

10.  What  are  the  minimum  dimensions  for  the  doors  in  a building  contain- 
ing explosives? 

Answer  and  reference: 

TOOELE  ARMY  DEPOT 

WINS  NATIONAL  SAFETY  COUNCIL  AWARD  OF  HONOR 


Tooele  Army  Depot  was  the  recent  recipient  of  a National  Safety 
Council  Award  of  Honor  for  having  achieved  more  than  7,000,000  man-hours 
without  a disabling  injury.  COL  Ralph  C.  Robinson,  Commanding  Officer, 
Tooele  Army  Depot,  is  shown  accepting  the  award  from  Depot  Safety  Director, 
Lyle  E.  Colbath. 
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THE  SHOCKING  FACTS 


Does  a 3-wire  system  in  portable  appliances,  extension  cords,  etc., 
insure  protection  against  electrical  shock?  If  your  answer  is  emphatically 
"Yes , " you  should  give  some  additional  thought  to  the  question.  Given  a 
few  moments  for  the  additional  thought,  you  might  possibly  add,  "Yes, 
if....,"  and  the  remainder  of  your  statement  should  convey  that  3-wire 
systems  will  only  provide  that  degree  of  safety  equivalent  to  the  system's 
original  construction  and  continued  maintenance. 

A case  in  point  is  a recent 
AMC  accident  involving  the  use  of 
a 3-wire  electric  drill  and  exten- 
sion cord.  The  worker  was  wearing 
electrical  safety  shoes  while 
standing  on  a dry  surface,  and  was 
still  severely  shocked. 

How  can  this  be  with  a 3-wire  sys- 
tem? In  this  particular  case,  the 
extension  cord  had  an  exposed  hot 
wire  at  the  connector.  (See  photo 
at  right.)  The  worker  evidently 
came  in  contact  with  the  hot  wire 
and  at  the  same  time  made  contact 
with  the  body  of  the  drill.  This 
allowed  current  to  flow  from  the 
hot  wire  through  his  body  to  the 
third  wire  grounded  drill.  Result? 

....One  disabling  injury. 

How  can  recurrence  of  this  type  accident  be  avoided?  AMCR  385-100, 
paragraph  6-21,  gives  us  that  answer  as  follows: 

"Because  of  the  necessity  of  safeguarding  persons  against  the 
hazards  of  defective  portable  appliances,  cords  and  plugs,  more  than 
ordinary  care  shall  be  exercised  with  regard  to  their  maintenance. 

"1.  Each  portable  appliance  shall  be  assigned  a number  and  shall 
be  inspected  and  tested  by  a qualified  individual  on  a regular  schedule. 

"2.  The  frequency  of  tests  shall  be  determined  by  the  degree  of 
service,  and  shall  be  in  sufficient  detail  to  uncover  any  defects. 

"3.  A written  record  of  the  tests,  defects  found  and  repairs 
made  shall  be  kept. 
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"4.  It  is  recommended  that  the  maintenance  inspections  and  tests 
be  made  by  qualified  personnel  of  the  electrical  department  and  that  spot 
checks  of  the  equipment  against  the  records  be  made  by  a member  of  the 
Safety  Office. 

"5.  Employees  about  to  use  portable  appliances  should  examine 
them  for  obvious  deficiencies  in  the  appliances,  the  cords  and  plugs . If 
any  deficiency  is  noted,  the  appliances  shall  not  be  used  but  shall  be  re- 
turned to  the  electrical  department  for  repairs.” 

Three-wire  systems  of  portable  appliances,  cords,  etc.,  do  provide  a 
measure  of  electrical  shock  protection.  This  degree  of  protection  is 
surely  enhanced  by  the  proper  construction  of  the  device  and  maintenance 
on  a continuing  basis  as  outlined  in  AMCR  385-100. 
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■ Here  are  the  answers  to  the  questions  on  pages  2 8 and  2 9.  A refer- 
ence to  the  pertinent  regulation  and  paragraph  follows  each  answer. 


1.  When  an  accident  occurs,  immediate  action  shall  be  taken  by  the 

safety  director  to: 

a.  Interview  the  injured  person  before  he  is  sent  home  or  to  the 
hospital  when  delay  of  treatment  will  not  jeopardize  the  in- 
jured; 

b.  Visit  the  scene  of  the  accident  to  observe  conditions  as  they 
were  or  might  have  been  at  the  time  of  the  accident; 

c.  Obtain  details  of  the  injury  from  the  medical  department; 

d.  Prepare  or  obtain  photographs,  diagrams,  sketches,  and  maps  as 
warranted  by  the  circumstances ; 

e.  Confer  with  foremen,  supervisors  and  witnesses  for  information  as 
to  cause; 

f.  Examine  safety,  medical,  and  personnel  department  records  on  the 
injured  person's  previous  history,  physical  conditions  and  indi- 
vidual accident  experience; 

g.  Plan  corrective  measures  with  the  foremen  and  other  interested 
parties ; 

h.  Complete  the  necessary  accident  reports; 

i.  Establish  a follow-up  on  the  application  of  recommended  corrective 
measures ; 

j.  Follow  through  for  exact  information  pertinent  to  the  return  of 
the  injured  to  work. 

Reference  paragraphs  l-22a  through  j,  AMCR  385-100. 
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2.  Approved  lightning  protection  systems  are  the  integrally  mounted  sys- 
tem, the  separately  mounted  shielding  system  (mast  type),  and  the 
separately  mounted  shielding  system  (overhead  ground  wire).  Refer- 
ence paragraph  8-2,  AMCR  385-100. 

3.  Materials  handling  procedures  should  be  in  conformity  with  the  fol- 
lowing basic  rules: 

a.  Keep  material  moving  uniformly  through  the  process  steps. 

b.  Minimize  unnecessary  rehandling. 

c.  Eliminate  heavy  manual  lifting. 

d.  Reduce  transport  distances  wherever  possible. 

e.  Provide  special  handling  equipment,  such  as  conveyors,  forklift 
trucks,  etc.,  where  practicable. 

Reference  paragraphs  9-3a(l)  through  (5),  AMCR  385-100. 

4.  Storage  magazines,  in  general,  should  not  be  provided  with  heat.  Ex- 
ception is  made  in  the  case  of  magazines  where  heating  is  necessary 

to  prevent  condensation  of  moisture,  to  maintain  constant  temperature, 
or  other  reasons.  Reference  paragraph  18-5b,  AMCR  385-100. 

5.  Ammunition  and  explosives  are  grouped,  for  compatibility,  with  respect 
to  the  following  factors: 

a.  Effects  of  explosion  of  the  item. 

b.  Rate  of  deterioration. 

c.  Sensitivity  to  initiation. 

d.  Type  of  packing. 

e.  Effects  of  fire  involving  the  item. 

f.  Quantity  of  explosives  per  unit. 

Reference  paragraphs  19-2a  through  f,  AMCR  385-100. 

6.  Each  part  of  the  installation  should  be  inspected  on  a scheduled 
basis  for  common  fire  causes  such  as  poor  housekeeping,  smoking 
violations,  excessive  accumulation  of  flammable  materials,  improper 
storage  of  flammable  materials,  process  fire  hazards,  blocked  fire 
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doors  and  exits,  seasonal  fire  hazards,  and  other  fire  hazards.  In- 
spection of  sprinklers,  fire  doors,  fire  exit  doors,  portable  ex- 
tinguishers, hose  lines  and  fire-fighting  equipment  will  be  scheduled 
and  records  maintained.  Reference  paragraphs  12- 6a  and  b,  AMCR  385-100 

An  "Explosives  Accident"  is  an  unplanned  explosion  or  a fire  invol- 
ving explosives  under  Army  custody  resulting  in  one  or  more  fatal  or 
disabling  injuries  to  persons,  or  damage  to  Government  or  private  pro- 
perty in  the  amount  of  $ 1,000  or  more.  Reference  paragraph  2- 16a, 

AR  385-40. 

Reporting  commands,  installations  and  activities  will  forward  the 
original  DA  Form  2398  direct  to  the  Director,  AMC  Field  Safety  Agency, 
to  arrive  not  later  than  the  5th  calendar  day  of  the  month  following 
the  month  for  which  accident  exposure  is  being  reported.  Reference 
Routing,  paragraph  2a,  appendix  USAMC  Suppl  1 to  AR  385-40. 

Explosive  plant  clothing  must  be  fastened  with  nonmetallic  fasteners 
and  must  be  easily  removable.  Pockets  must  be  of  the  lattice  type. 
Trouser  legs,  slacks  and  sleeves  should  be  tapered  and  the  trouser 
legs  and  slacks  shall  be  without  cuffs,  and  should  extend  over  the 
top  of  shoes  or  boots.  The  garment  should  fit  snugly  around  the 
wrist  and  neck  but  caution  must  be  exercised  to  avoid  a fit  around 
the  waistband,  belt,  or  neck  sufficiently  tight  to  cause  skin  irrita- 
tion or  dermatitis.  These  garments,  as  well  as  head  coverings, 
should  be  made  from  tightly  woven,  smooth  fabric  and  shall  be  flame- 
proofed  or  made  of  material  which  has  flame  retardant  qualities  at 
least  equal  to  flameproofed  clothing.  Reference  paragraph  10-6b, 

AMCR  385-100. 

Exit  doors  in  buildings  containing  explosives  shall,  in  no  case,  be 
less  than  30  inches  wide  by  78  inches  high.  Reference  paragraph 
5-8,  AMCR  385-100. 
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THE  SYSTEM  SAFETY  PROCESS 


In  the  September-October  issue  we  discussed  both  System  Safety 
Testing  and  System  Safety  Application,  Although  the  "System  Safety 
Process"  may  appear  to  have  been  required  before  the  other  two  articles 
it  was  thought  prudent  to  provide  some  "how  to  do  it"  philosophy  in- 
itially and  then  follow  with  the  "process"  description. 

If  the  illustration  on  the  next  page  looks  familiar,  it  is  because 
it  was  lifted  from  the  draft  revised  AMC  Pamphlet  385-23.  It  had  its 
genesis  in  Chapter  3,  AMC  Pamphlet  706-203  and  was  modified  in  a Technical 
Report  by  the  US  Army  Agency  for  Aviation  Safety.  This  scheme  shows  (in 
their  Report  72-8)  how  the  "process"  works  for  aviation  systems,  but, 
its  application  to  the  total  system  safety  endeavor  was  self-evident. 

Thus,  the  narrative  has  been  organized  to  fit  it  into  the  process  for 
any  system.  The  remainder  of  this  article  discusses  the  individual 
blocks  in  some  detail,  but  a little  less  formally  than  the  Pamphlet. 

Basically,  the  process  follows  a classical  safety  pattern  through  which 
anything  considered  worth  building  proceeds.  Although  the  individual 
blocks  are  shown  in  a logic  sequence,  this  sequence  is  not  sacrosanct, 
for  one  can  enter  the  process  at  any  point  and  any  step  can  be  repeated 
as  required.  It  works  for  any  level  of  development  or  procurement,  from 
the  simplist  item  to  the  most  complex  system.  All  you  have  to  do  is 
decide  where  you  are  when  you  begin  and  this  depends  on  the  end  item  and 
its  life  cycle.  In  this  discussion,  we  assume  that  a requirement  for  an 
item  has  been  validated  and  the  early  concept  formulation  and  operational 
concept  has  been  established. 

BLOCK  A - KNOWN  PRECEDENT 

When  the  developer  peers  over  his  crowded  desk  and  has  to  decide  how 
his  project  will  unfold,  the  first  thing  he  should  think  of  is  whether 
there  is  any  past  history  of  undesirable  qualities  in  a similar  item.  If 
there  is,  then  he  will  automatically  know  that  the  "new"  item  must  avoid 
them,  if  it  isn't  to  be  the  same  headache  to  the  user  that  he  had  to  spend 
time  correcting  before.  If  there  isn't,  then  he  will  have  thoroughly  screened 
the  multiplicity  of  sources  to  find  out.  The  logic  of  this  step  is  to  id- 
entify, collect,  and  use  historical  detail  to  avoid  mistakes  made  before. 

BLOCK  B - SYSTEM  DELINEATION 

Once  history  is  relegated  to  the  bookshelf  (but  nevertheless  remem- 
bered) the  "new"  system  must  be  described  in  the  most  precise  terms.  One 
must  know  the  environment  in  which  it  is  expected  to  operate,  its  antic- 
ipated performance  envelope,  whether  people  are  part  of  it  or  merely  ob- 
servers, what  it  will  replace,  and  whether  a significant  improvement  in 
operating  characteristics  will  be  realized.  Each  of  these  features  is  ex- 
plained by  the  entity  that  generates  the  requirement  and  the  safety  man 
is  expected  to  participate  in  each  determination  so  that  selection  of  some 
impossible  parameter  isn't  an  oversight  that  may  prove  embarrassing  later. 
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Figure  1 

SYSTEM  SAFETY  PROCESS 
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(AS  REQUIRED) 


BLOCK  C - SYSTEM  HAZARD  ANALYSIS  (SHA) 


The  basis  for  this  rather  all-inclusive  title  is  to  conceive  of  all 
the  ways  in  which  a system  or  process  could  cause  difficulty.  The  primary 
question  to  be  asked  in  this  area  is,  "what  if  such-and-such  happens?"  Many 
of  the  answers  will  be  nebulous  initially,  because  definitive  analyses 
have  yet  to  be  made.  Likewise,  many  postulated  situations  will  seem  to 
surface  from  the  art  of  bending  over  backwards  to  manufacture  analytical 
work.  In  balance,  it  will  be  necessary  to  use  mature,  professional  judge- 
ment to  determine  how  elaborate  the  answer  to  any  question  need  be.  It 
is  not  necessary  to  answer  the  question,  "what  happens  if  a man  contacts 
a 220  volt,  20  ampere  electrical  source?"  It  should,  however,  be  mand- 
atory that  the  possible  condition  that  could  bring  him  into  contact  with 
such  a source  be  thoroughly  analyzed  and  eliminated.  Analysis  of  the 
system  in  a methodical  manner,  beginning  with  the  Preliminary  Hazard 
Analysis  (PHA)  of  the  design  and  continuing  all  the  way  through  the  SHA 
will  insure  that  the  job  is  done  without  becoming  bogged  down  in  hopeless 
detail.  A number  of  techniques  are  available  for  these  analyses,  e.g.. 
Failure  Mode  and  Effect  (FMEA),  Fault  Tree  (FTA),  and  Technique  for  Human 
Error  Prediction  (THERP). 

BLOCK  D - HAZARD  IDENTIFICATION 

Once  the  hazard  analyses  disclose  potential  problems  in  the  system, 
the  specific  hazards  can  be  identified  and  marked  for  elimination  or 
control.  Blocks  C and  D more  or  less  go  hand-in-hand,  since  one  is  of 
little  value  without  the  other.  In  other  words,  hazards  (except  for  an 
obvious  one,  as  above)  cannot  be  identified  unless  the  system  is  analyzed. 
Likewise,  analysis  is  of  no  value  unless  its  purpose  is  to  disclose 
potential  hazards. 

BLOCK  E - HAZARD  CATEGORIZATION  AND  EVALUATION 

It  is  not  possible  to  be  absolutely  sure  that  any  hazard  can  be 
eliminated  and  attempts  to  eliminate  all  hazards  will  be  impractical.  Thus, 
categorization  of  hazard  levels  according  to  MIL-STD-882  in  terms  of  sev- 
erity (ranging  from  no  danger  at  all  to  complete  destruction  of  a system) 
is  required.  We  often  design  the  human  out  of  a portion  of  a system,  but 
we  will  never  be  able  to  eliminate  his  potential  for  making  mistakes  in 
that  part  where  he  still  performs.  The  analytical  techniques  mentioned 
earlier  are  put  to  good  use  within  the  hazard  classification  description 
in  the  Standard.  The  criteria  which  has  been  found  excellent  for  this 
kind  of  categorization  can  be  summarized  as  follows: 

1.  In  looking  at  any  particular  potential  hazard,  determine  the 
"worst-case"  if  it  were  not  eliminated  or  controlled. 

2.  Evaluate  the  effect  that  hazard  would  have  on  the  mission  of 
the  system;  whether  people  would  suffer  injury,  how  much  damage  would  be 
done  to  equipment,  and  the  ultimate  effect  the  event  would  have  on  the 
total  system  acquisition  and  operational  program. 


37 


If  we  take  these  two  prime  criterion  and  amplify  them  a little  we 
can  immediately  see  that  the  major  hazard  causes  are  personnel  error, 
environmental  conditions,  poor  design,  improper  procedures,  and  the  ancient 
headache  -•  it  just  comes  apart  for  no  apparent  reason,  or  doesn’t  function 
as  it  should. 

Going  to  the  next  step,  the  effects  of  all  these  unusual  events  can 
be  ranked  according  to  levels  or  degrees  of  severity  and  the  probabilities 
of  occurance  under  all  operating  conditions  determined.  Once  this  is  done, 
the  cost  of  correcting  the  situation  can  be  readily  established.  Here  is 
where  trade-off's  will  occur  in  terms  of  dollars,  actual  benefits  gained, 
schedules,  and  system  performance.  Summarizing  the  categorization, 
MIL-STD-882  ranks  hazards  in  this  manner: 

1.  Negligible  - you  have  no  problems  here. 

2.  Marginal  - you  had  better  look  closer;  change  a procedure, 
construct  a warning  sign,  or  enhance  operator  training. 

3.  Critical  - now  you  have  a major  problem;  someone  hasn't  done 
his  homework,  but  you  still  can  bail  yourself  out  with  strenuous  effort. 

4.  Catastrophic  - call  the  mortician  or  the  salvage  officer. 

BLOCK  F - ACTION(S)  TO  ELIMINATE  OR  CONTROL  HAZARD(S) 

Although  all  the  above  reads  well  and  is  good  philosophy,  nothing  done 
thus  far  will  prevent  the  first  mishap.  Management  is  responsible  for  this 
step,  based  on  recommendations  made  in  the  preceding  safety  analyses  and 
studies.  Undoubtedly,  this  is  the  most  crucial  step,  because  it  is  only 
here  that  practical  results  can  be  achieved.  Authority  must  be  granted  to 
redesign,  change  procedures,  and  do  those  things  which  inspire  confidence 
in  the  operator  when  he  uses  the  equipment. 

BLOCK  G - MODIFICATION  OF  SYSTEM  ELEMENTS 

As  an  outgrowth  of  the  previous  step,  the  actual  modification  of  some 
element  or  elements  of  the  system  takes  place.  For  example,  procedures  can 
be  revised,  initial  assumptions  on  the  operating  environment  can  be  amended, 
or  basic  specifications  can  be  changed.  Since  this  changes  the  system, 
its  initial  definition  and  some  elements  also  change;  therefore,  the  des- 
cription (Block  B)  must  be  revised.  The  process  is  repeated  until  no  un- 
acceptable hazards  are  generated.  This  repetition  ensures  that  actions 
taken  to  correct  one  hazard  do  not  induce  others  somewhere  else. 

BLOCK  H - EFFECTIVENESS  EVALUATION  OF  ACTION  TAKEN 

If  all  we've  done  thus  far  could  assure  us  that  we  were  100%  correct 
the  "process"  would  end.  The  measuring  tool  is  the  test.  The  test, 
whether  it  is  engineering,  development,  or  operational  proves  whether  the 
modification,  change,  or  whatnot  has  actually  improved  the  system  when 
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compared  to  the  established  objective.  Blocks  I and  J are  an  extension 
of  this  step.  We  thereby  increase  our  assurance  in  the  safety  level  of 
the  system  (Block  K)  by  "iterating"  through  this  one. 

BLOCK  I - ACCIDENT/ INCIDENT  ANALYSIS 

The  first  sub-step  of  Block  H is  an  obvious  fact  of  life,  i.e., 
any  accident  which  causes  death  or  major  destruction  must  be  thoroughly 
investigated.  Finding  the  true  cause  is  the  most  difficult;  and  in  par- 
ticular if  a "near  miss"  is  evident  an  investigator  has  a real  problem. 

The  "near  miss"  is  where  a situation,  if  continued  to  its  logical  con- 
clusion would  have  resulted  in  the  same  catastrophic  or  critical  condition. 
It  is  difficult,  because  human  nature  regards  an  end  result  as  more  im- 
portant than  the  underlying  cause,  particularily  if  the  event  did  not 
result  in  an  undesirable  situation  when  it  happened.  This  may  occur  once, 
twice,  or  any  number  of  times,  but  eventually  time  will  irun  out. 

Each  event  must  be  investigated  as  soon  as  possible  after  occurrence , 
otherwise  a delay  may  permit  removal  or  destruction  of  significant  evid- 
ence. Retention  of  damaged  equipment  for  post  mortem  examination  is  man- 
datory, otherwise  the  investigation  may  be  only  an  exercise  in  documen- 
tation research.  Once  the  investigation  is  underway,  there  are  several 
criterion  the  investigator  must  remember: 

1.  Find  the  exact  cause(s)  so  it  can  be  avoided  later. 

2.  Use  system  safety  analysis  techniques  to  determine  the  "change" 
or  "deviation"  that  produced  the  event. 

3.  Recommend  changes  in  procedures  or  hardware  to  prevent  repet- 
ition of  the  same  event. 

4.  Feed-back  the  data  to  support  product  improvements  or 
modifications. 

5.  Publicize  the  technical  detail  so  that  users  of  the  same 
equipment  can  avoid  identical  errors. 

6.  Record  the  data  for  future  reference,  so  that  one  does  not  have 
to  reinvent  the  wheel  again. 

BLOCK  J - COMPONENT/ SYSTEM  TEST  AND  DEMONSTRATION 

This  is  the  second  sub-step  of  Block  H and  along  with  Block  I results 
in  an  increased  assurance  that  the  system  will  indeed  meet  its  new  crit- 
eria. The  tests  and  demonstrations  verify  the  results  of  the  "process" 
and  give  confidence  in  the  assurances.  Hand-in-hand  with  accident/ incident 
analysis,  deficiencies  and  shortcomings  in  this  step  are  directed  to  other 
appropriate  steps  in  the  process  for  corrective  action. 
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BLOCK  K - INCREASED  SAFETY  ASSURANCE 


Where  the  effectiveness  evaluation  (Block  H)  indicates  that  the 
process  has  produced  the  desired  results,  assurance  that  the  objective 
has  been  met  is  also  increased.  The  next  time  we  go  through  this  process, 
as  an  element  of  system  qualification,  or  in  applying  the  process  to  the 
"next”  or  "another”  system,  we  continually  build  on  past  successes, 
while  simultaneously  correcting  deficiencies. 

V?  Vc  ^ 

The  System  Safety  Process  described  here  might  seem  unusually 
complicated,  but  if  the  individual  segments  are  scrutinized  carefully 
it  can  be  readily  seen  that  each  is  done  over  and  over  again  in  the 
routine  management  of  our  safety  programs.  To  the  staffer  who  faces  a 
mountain  of  paper  every  morning,  these  formal  steps  may  seem  remote  and 
far  away.  It  is  well,  though,  to  occasionally  look  at  the  total  scheme 
and  perhaps  that  little  piece  of  the  action  with  a suspense  tomorrow 
morning  may  seem  more  important  after  all.  Likewise,  to  the  technician 
operating  the  machine  that  produces  an  obscure  piece  of  a system,  his 
routine  may  not  seem  quite  so  insignificant  if  he  can  recognize  that 
he,  too,  contributes  to  the  success  of  the  whole.  Finally,  to  the 
operator  and  those  who  direct  his  activities,  the  "candid"  disclosure 
of  errors  and  hardware  problems  will  help  immeasurably  the  engineer  who 
often  has  to  guess  why  a particular  anomaly  occurred. 
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